Closed tal-zvon closed 5 years ago
Sounds like it may be related to this: https://github.com/logstash-plugins/logstash-codec-netflow/issues/58#issuecomment-274417666. Can anyone confirm?
Packet captures confirm that IPFIX from Mikrotiks had lengths < 20, which makes python-ipfix raise an IpfixDecodeError exception at around line 323 of message.py.
Mikrotik's RouterOS 6.37.5 had the bug, but updating to the next version up (6.38) fixed the issue, so if anyone else finds this experiencing the same problem with a Mikrotik, you're either stuck using Netflow 9, which seems to work fine, or you need to update to at least RouterOS 6.38.
ilmarh's example from: https://github.com/britram/python-ipfix/issues/17 works great for Netflow v9 (at least with my limited testing).
When I add
import ipfix.reader
, and change hisr = ipfix.v9pdu.from_stream(self.rfile)
to sayr = ipfix.reader.from_stream(self.rfile)
instead, it always throws an exception for me. The traceback says:The 2 isn't always a 2.
The flow is coming from a Mikrotik device. Am I doing something wrong? Or is the Mikrotik sending some improperly-formatted packets? PRTG seemed to have no issues collecting IPFIX data from the Mikrotik.
My full code looks like this: